Comprehensive abnormality judgment system based on multiple single type collection results

Abstract

The invention discloses a comprehensive abnormality judgment system based on multiple single type collection results, and relates to the technical field of network prewarning. The system comprises a threshold value generation unit and an abnormality judgment unit, wherein the threshold value generation unit calculates a judgment threshold value on the basis of collection data acquired from a collected system; and the abnormality judgment unit judges whether the collected system is operated normally or abnormally on the basis of the judgment threshold value and the collection data. The system disclosed by the invention judges various modes of the acquired data, so as to accurately identify an operation condition of the detected system under a condition of no contact with a background log orhardware data of the detected system; and the problems that the interference resistance is extremely low due to use of an average value for calculation, the fixed threshold value judgment performanceis extremely low, and a threshold value fluctuation range setting scheme is single and low in efficiency are solved.

Description

technical field [0001] The invention relates to the technical field of network early warning, in particular to a comprehensive abnormal judgment system based on multiple single-type collection results. Background technique [0002] In the prior art, there are the following methods for judging abnormality of a single type of data collected repeatedly: [0003] Method 1, using a fixed threshold, that is, the operation and maintenance personnel give a fixed interval as a fixed threshold based on experience, and the system determines whether the data is abnormal by comparing with the fixed threshold. Method 1 is simple to implement, and is more suitable for systems with little data fluctuation or relatively absolute abnormal judgment, but various problems will be exposed in systems with large-scale data fluctuations. When the fixed threshold is set too high, false alarms will occur. It is a waste of manpower and material resources; if the setting is too low, there will be false...

AI Technical Summary

Problems solved by technology

The idea of ​​method 5 based on contemporaneous data itself has strong performance, but the shortcoming is that the average value is simply used without processing, so the defects of the average value also exist, and method 5 has no obvious periodicity. The detection system can also have problems with insufficient performance

[0008] In summary, the abnormality judgment method for a single type of data always has inevitable defects: simply using the average value to calculate the anti-interference is too weak, the judgment performance of the fixed threshold is too poor, and the threshold fluctuation range setting scheme is single and inefficient

Images